Malicious PDF — malware analysis report

Static analysis result for SHA-256 f10482aa90d6ac72…

MALICIOUS

PDF

76.6 KB Created: 2021-03-12 22:00:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 47bb08e635e529245e9b5daf360295f2 SHA-1: db154aa499542abf2a08cf194584997df0b81e53 SHA-256: f10482aa90d6ac729cdf1becea1a77c645f1cbd21f1904b389b196ac3f87e4a7
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by multiple heuristics, including a high ML score and ClamAV detection, and exhibits characteristics of an advance-fee scam. The document body, though heavily obfuscated, combined with the PDF_URI heuristic pointing to a suspicious URL, suggests the document is designed to trick the user into visiting a malicious site. No scripts were extracted from this sample, but the presence of embedded URLs and the advance-fee scam lure strongly indicate a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=bandolero+race+car+setup
    • http://raifaisentgo.online/933391041358fcqw.pdf
    • http://rezisekuvaz.mypressonline.com/pringles_ring_stem_challenge.pdf
    • http://onlineeshop24.xyz/gosefuxdonz1.pdf
    • http://koponegigat.medianewsonline.com/36625541636.pdf
    • http://vemusopudin.22web.org/64201968213.pdf
    • https://static.s123-cdn-static.com/uploads/4482216/normal_5fc5b33a75e60.pdf
    • http://rumurel.mywebcommunity.org/39308047764.pdf
    • http://digitaltoolsfor.xyz/game_of_thrones_episode_recap_season_3pagzv.pdf
    • https://cdn-cms.f-static.net/uploads/4465539/normal_5fe89c856c2d0.pdf
    • http://republvinb.fun/game_genie_ps3_white_knight_chronicles_2_codeshxo0b.pdf
    • http://polobasopika.mywebcommunity.org/sogogaxa.pdf
    • http://bumumapa.mypressonline.com/c_map_example.pdf
    • http://fodekofuxuvum.sportsontheweb.net/why_is_the_short_run_aggregate_demand_curve_is_upward_sloping.pdf
    • http://sudoniwitexife.22web.org/the_story_of_artemis_and_actaeon.pdf
    • https://cdn-cms.f-static.net/uploads/4369933/normal_601233301a544.pdf
    • http://bcpzonasegurape2-viabcp.com/the_elusive_quest_for_growth_chapter_12_summaryid5qz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://letituxis.epizy.com/how_to_tell_mikuni_carb_size.pdf
    • http://namakanexir.atwebpages.com/pelonud.pdf
    • http://sawopirorafo.rf.gd/clavier_arabe_azerty_apk.pdf
    • http://fopugaxug.rf.gd/personal_information_questions_and_answers.pdf
    • http://fixidil.atwebpages.com/mozupuxidetegezabozu.pdf
    • http://medazupu.onlinewebshop.net/win_10_keyboard_shortcuts_settings.pdf
    • http://lobakixadob.epizy.com/angelic_sigils_keys_and_calls_free.pdf
    • http://sosejuxosi.epizy.com/panolerojisi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f062.bin
69089a61aca744daa5b17fae8a51fc49b9af2dc09eb94ae91007ecebcc1f15ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF062 5116 bytes
font_01_sfnt_off000101d5.bin
d4771f9c073d8cb8428a26957cf57735737f103894a7b819e2cbd90b094c9171		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101D5 10264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.